CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
In the Linux kernel, the following vulnerability has been resolved:
xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst()
On the error path where in6devget(dev) returns NULL, xfrm6filldst() releases the device reference with netdevput() but leaves xdst->u.dst.dev set. dstdestroy() later calls netdevput(dst->dev) again, so the same netdevice reference is released twice, underflowing its refcount (reftracker WARNING + "unregisternetdevice: waiting for <dev> to become free").
Clear xdst->u.dst.dev after the netdevput(), the same way the XFRM device-offload paths xfrmdevstateadd() and xfrmdevpolicyadd() in net/xfrm/xfrmdevice.c NULL ->dev when releasing the reference on error.
reftracker: reference already released. reftracker: allocated in: xfrm6filldst (net/ipv6/xfrm6policy.c:86) ... udpv6sendmsg (net/ipv6/udp.c:1696) ... reftracker: freed in: xfrm6filldst (net/ipv6/xfrm6policy.c:90) ... WARNING: lib/reftracker.c:322 at reftrackerfree+0x58b/0x780 dstdestroy (net/core/dst.c:115) rcucore handlesoftirqs ...
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64580?
The severity of CVE-2026-64580 is rated as risk 27.
How do I fix CVE-2026-64580?
To fix CVE-2026-64580, you should upgrade your Linux kernel to the latest version that includes the patch for this vulnerability.
What impact does CVE-2026-64580 have on system security?
CVE-2026-64580 can potentially lead to a denial of service due to improper handling of network device references.
In which versions of the Linux kernel does CVE-2026-64580 exist?
CVE-2026-64580 exists in specific versions of the Linux kernel prior to the vulnerability being patched in the latest releases.
How was CVE-2026-64580 discovered?
CVE-2026-64580 was discovered during the code review and analysis of the xfrm code within the Linux kernel.